A concerning wave of viral videos circulating across X, Instagram, and Reddit has triggered widespread panic regarding the localized security of budget electric vehicles (EVs) in India. The trending clips depict pranksters utilizing a smartphone application to abruptly shut off moving electric rickshaws and scooters from a short distance, leaving drivers stranded mid-traffic and raising immediate public safety warnings.
At the center of the controversy is BAT-BMS, a legitimate battery monitoring application developed by Chinese firm Shenzhen Grenergy Technology Co., Ltd. Designed to help owners track cell voltage, temperature, and charging metrics via Bluetooth Low Energy (BLE), the app features a diagnostic switch to toggle a battery’s power discharge circuit. Because numerous budget e-rickshaws utilize inexpensive, Chinese-manufactured Battery Management Systems (BMS) shipped with default open settings and little to no password protection, anyone within a 10-to-15-meter radius can connect to an unauthenticated battery and turn off its power output.
Security experts emphasize that the phenomenon is an issue of poor authorization protocols rather than sophisticated remote hacking. The exploit is entirely limited to unencrypted, Bluetooth-enabled lithium battery packs, meaning vehicles running on traditional lead-acid batteries or proprietary encrypted systems remain unaffected. Nevertheless, automotive safety analysts have warned that killing vehicle acceleration mid-ride poses immense danger to passengers, prompting firms like TraceX Labs to issue immediate technical advisories advising operators to alter factory-default credentials.
